helloworld 正在参加 2021 年度 OSC 中国开源项目评选,请投票支持!
helloworld 在 2021 年度 OSC 中国开源项目评选 中已获得 {{ projectVoteCount }} 票,请投票支持!
2021 年度 OSC 中国开源项目评选 正在火热进行中,快来投票支持你喜欢的开源项目!
2021 年度 OSC 中国开源项目评选 >>> 中场回顾
helloworld 获得 2021 年度 OSC 中国开源项目评选「最佳人气项目」 !
授权协议 MIT License
开发语言 JavaScript
操作系统 跨平台
软件类型 开源软件
所属分类 插件和扩展Atom 插件
开源组织
地区 不详
投 递 者 首席测试
适用人群 未知
收录时间 2021-12-17

软件简介

🔮 Hello, world.

federated social web blog
using the foundation of CRA-all-the-things

CI status CI status license

NOTE: still under active development and I'm not currently providing backwards compatibility until things stabilize.

📯 Description

federated social web blog app. in short, i'm trying to build an open-source Tumblr (RIP). passes SWAT0!

Features

  • social features:
    • RSS reader
    • oStatus stack, WebSub/Salmon/Webfinger
    • commenting
    • api to follow/reblog content (pretty basic right now)
  • WYSIWYG editor
    • edit content in page, or add new content via dashboard
    • rich content pasting (paste in url/embed and we'll grab the video or image)
    • tagging objects through #catvideo and people @bestfriendforevs
    • different templates (namely, albums currently)
    • CSS/JS/HTML editing via CodeMirror
  • technology features:

💾 Install

npm install

Then, to run your newly created server locally, with the Storybook styleguide server:

npm start

Prerequisites: Node 13+ if you want proper internationalization (i18n) support (via full-icu).

Or, to run locally without the Storybook styleguide server:

npm run serve:dev

To run in production (or better yet check out bin/flightplan.js)

npm --production install
# TODO(mime): annoyingly, you'll need to build the hello-world-editor/social-butterfly separately b/c npm workspaces isn't so robust yet.
# in flightplan.js i hack around this by removing the workspaces, ugh.
npm run build
npm run serve:prod

To run tests:

npm run test

To change port, in an .env change the values to what you would like

PORT=3000
REACT_APP_SSR_PORT=3001

To run migrations:

npx sequelize db:migrate && npx sequelize db:seed:all

To create a new migration:

npx sequelize migration:generate --name [migration_name]

To learn more about Sequelize and migrations, read the docs here.

To extract i18n messages (they go into the folder build/messages):

npm run extract-messages

To use Docker:

npm run dev

and then MySQL will be available on port 3002 (with username/password/database name all being allthethings). Redis will be on port 3003. To set up Redis be sure to set REACT_APP_REDIS_HOST and REACT_APP_REDIS_PORT.

🎯 Goals

  • pass SWAT0
  • open source
  • quick to install
  • be a good, straightforward-to-use alternative to what's out there!

🗺️ Roadmap

p0 (high pri)

  • creating comment doesn't load in comment properly (text missing)
  • replying from dashboard when body of editor isn't selected throws error
  • possible to pause compilation while building package?
  • apostrophe in title makes it not hidden, e.g. Don-t-deploy-on-Fridays-wRXma4oxja
  • Multiple app capable
  • getting negative counts on dashboard - regression
  • Fault tolerant http
  • rm antiCache with migration to React hook <- needed anymore?
  • Package directories build sanely
  • Reader WordPress alt Tumblr alternative
  • freeze HMR when re-building
  • when done with editing doesn’t have latest version
  • don't have edit link on feed page / or redirect to content page
  • graphql errors should surface to top
  • use rebound?
  • end debugger debugger on run, to be safe?
  • bin / fly prod should have npm corresponding command
  • think about igor's feedback re css and other stuff
  • high-res picture load in app, not new link
  • hw loading old entries if purged prbly
  • sorting should refresh feed
  • pasting iframe into editor doesn’t work (npr video embed)
  • fix img sizes in comments (too big - see example on nite-lite about page)
  • Email is formatted wrong when getting webmention (says self sent email)
  • don't update updatedAt for view
  • migrate from user context to local state
  • split off dashboard, admin panel, draft.js code, auth0, and lodash code for performance
  • social api:
  • twitter embed support
  • editor
    • onbeforeleave fix after posting once
    • drop anywhere on page
    • don’t replace when uploading twice
    • don’t allow links to be clicked in editor
    • something wrong with toolbars editing (multiple)
    • grab thumb from first image (if pasted in)
    • when finishing editing doesn’t show new version
    • show uploading spinner
  • fix linting / compilation checks in packages
  • get rid of trailing slash on profile page
  • make install instructions dead-simple, one-liner with mysql mock db setup.
  • render HTML with inline styling (e.g. mentions)
  • getting an error in graphql seems to freeze the apollo server. if so, update all-the-things, too.
  • same Apollo query twice causes SSR to fail with htmlHead, wtf.
  • more GraphQL examples:
    • fragments
      • also, things like fetchPublicUserData should be part of the graph not separate queries
    • local state
    • subscriptions
    • check out dataloader: https://github.com/graphql/dataloader
    • generate automatically schemas/typedefs
  • generator steps for Sequelize files
  • see if lazy attribute can be a good substitute for ContentThumb's delay-loading logic (chrome 75)
  • finish up Admin panel to add/delete users
  • loading state when following someone new
  • incorrect url (i.e. with http:) follow error on dashboard

p1 (medium pri)

  • web components? (e.g. check out youtube.com)
  • update material-ui with proper theme (instead of pixel.css)
  • should follow self in dashboard, when posting new comment it goes to 'user remote' version.
  • add site loading/working component, say when following a feed and it's working.
  • hubspot's draft-extend / draft-convert might be a better route than draft-js-plugins, maybe combine the two editors
  • more winston logging
  • links template should only open embeds in lightbox?
  • images open in lightbox
  • editor features to bring back (from Python version)
    • use CSS-in-JS in editor package to avoid having to import separately
    • add snackbar close action
    • better emoji picker (can use EmojiOne's)
    • custom emojis
    • gotta fix @-mentioning for editing content (works for dashboard only now)
    • draft.js:
      • move paste code out of main index.js
      • custom tab behavior - draft.js's default is terrible
      • add markdown
      • add inline-code
      • add empty newline always at end of doc
      • image upload progress (or indeterminate loading "spinner")
      • unfurl should have "(via link)"
      • take a look at utils codebase: https://github.com/jpuri/draftjs-utils
      • code, use prism syntax highlighting
      • google maps embed
      • can’t import CSS for some reason into webpack from node_modules (from draft-js-plugins)
      • DraftEntity.get/create deprecated
      • multiple images - single undo instead of two (also when pasting unfurl)
      • use something instead of ' ‘ and ‘a’ for atomic blocks
      • convertFromHTML bug - this will fail <figure> <img src=""> </figure> but w/o whitespace won’t
      • toolbar don’t move on click (position so it doesn’t go off screen), get rid of scale
      • checklist / tasklist
      • dnd + align toolbars don’t actually work
      • htmlToEntity has extra data (entity and node both have the same data :-/), need to update attachment.js, unfurl.js, Iframe.js, Image.js, Blocks.js
    • create new sections / albums, renames (and redirects)
    • content rename (and redirects)
    • draggable, be able to drag album, sitemap, followers and move to different categories
    • some content is uneditable (like from Simple.js)
    • audio/video uploads
    • css/js live updates to wysiwyg
    • figcaption
  • dashboard: better way to sandbox remote content?
  • search should have InfiniteFeed
  • bring back old features (from Python version)
    • data liberation, ability to port data to another site/service
    • themes
    • forums
    • events
    • store
    • slideshow
    • favorites and shares
    • spam control
    • webfinger if http://ostatus.org/schema/1.0/subscribe present then show Follow button for user
    • fb/google+/twitter mirroring (backwards compatibility ;)
    • media manager: had support for video/audio/images
    • resumable uploads
    • edit images
    • newsletter, google analytics, basic ads, adult content flag
    • Structured data w movies music
    • content management
      • drag & drop to move sections
      • drag & drop to move content in albums
      • have hidden content
      • change section/album/thumb/hidden/template/thumb in content editor
      • be able to delete from within content editor
  • friendica, other webfinger/host-meta tech
    • check out oexchange (see friendica)
    • check out amcd (see friendica)
    • why does friendica have salmon magic-key at top level host-meta file?
  • dashboard/item.js update() is called so much there's a race condition and sometimes the apollo store gets -1

p2 (ideas)

  • look at/switch over to a React Hook

📙 Learn More

Changelog

Code of Conduct

Contributing

Contributors

Support

📜 License

MIT

(The format is based on Make a README)

展开阅读全文

代码

评论

点击引领话题📣
暂无内容
发表了博客
{{o.pubDate | formatDate}}

{{formatAllHtml(o.title)}}

{{parseInt(o.replyCount) | bigNumberTransform}}
{{parseInt(o.viewCount) | bigNumberTransform}}
没有更多内容
暂无内容
发表了问答
{{o.pubDate | formatDate}}

{{formatAllHtml(o.title)}}

{{parseInt(o.replyCount) | bigNumberTransform}}
{{parseInt(o.viewCount) | bigNumberTransform}}
没有更多内容
暂无内容
Moment.js 正则拒绝服务漏洞
拒绝服务
Moment.js 是一个 JavaScript 日期库。用于解析、验证、操作和格式化日期。 Moment.js 在处理嵌套 rfc2822 注释内容时正则表达式执行时间不断的指数增大,导致服务不可用。 攻击者可利用该漏洞使目标服务停止响应甚至崩溃。
CVE-2022-31129 MPS-2022-11159
2022-08-08 21:03
ramda 存在拒绝服务漏洞
拒绝服务
此软件包的受影响版本容易受到源/修剪中的正则表达式拒绝服务 (ReDoS) 的攻击。
MPS-2022-13991
2022-08-08 21:03
simple-get 信息泄露漏洞
信息暴露
Simple-Get是美国的一个使 Http 获取请求的最简单方法。 simple-get 存在信息泄露漏洞,该漏洞源于在NPM中暴露敏感信息给未经授权的参与者。
CVE-2022-0355 MPS-2022-2533
2022-08-08 21:03
Immer 安全漏洞
使用不兼容类型访问资源(类型混淆)
Immer是Immer社区的一个基于Javascript的状态管理库。。 immer 9.0.6之前版本存在安全漏洞,该漏洞源于当path参数中使用的用户提供的密钥是数组时,可能导致绕过CVE-2020-28477。
CVE-2021-23436 MPS-2021-19475
2022-08-08 21:03
Digital Bazaar Forge 输入验证错误漏洞
跨站重定向
Digital Bazaar Forge是美国Digital Bazaar公司的一个 Tls 在 Javascript 中的本机实现以及用于编写基于加密和网络密集型 Web 应用程序的开源工具。 Digital Bazaar Forge 中存在输入验证错误漏洞,该漏洞源于产品允许URL重定向到不受信任的站点。
CVE-2022-0122 MPS-2022-0421
2022-08-08 21:03
Digital Bazaar Forge数据伪造问题漏洞
密码学签名的验证不恰当
Digital Bazaar Forge是美国Digital Bazaar公司的一个Tls在Javascript中的本机实现以及用于编写基于加密和网络密集型Web应用程序的开源工具。digitalbazaar Forge 1.3.0之前版本存在数据伪造问题漏洞,该漏洞源于RSA PKCS#1 v1.5签名验证码在解码 `DigestInfo` ASN.1 结构后不检查尾随垃圾字节。攻击者可以删除填充字节利用该漏洞添加垃圾数据以伪造签名。
CVE-2022-24772 MPS-2022-3739
2022-08-08 21:03
Digital Bazaar Forge数据伪造问题漏洞
密码学签名的验证不恰当
Digital Bazaar Forge是美国Digital Bazaar公司的一个Tls在Javascript中的本机实现以及用于编写基于加密和网络密集型Web应用程序的开源工具。Digital Bazaar Forge1.3.0之前版本存在数据伪造问题漏洞,该漏洞源于SA PKCS#1 v1.5签名验证码无法正确检查DigestInfo以获得正确的 ASN.1 结构。攻击者可以发送特殊的签名利用该漏洞以验证包含无效结构但有效摘要的签名。
CVE-2022-24773 MPS-2022-3740
2022-08-08 21:03
Auth0 安全漏洞
XSS
Auth0是是一个身份验证代理,支持社会和企业身份提供者,包括Active Directory、LDAP、谷歌Apps和Salesforce。 auth0-lock 11.32.2版本及之前版本存在安全漏洞,该漏洞源于当配置了附加注册字段功能时,攻击者可以将无效的 HTML 代码注入这些附加字段,攻击者利用该漏洞可通过注入 HTML 来制作恶意链接,然后在交付的电子邮件模板中将其呈现为收件人的姓名。
CVE-2022-29172 MPS-2022-8573
2022-08-08 21:03
Components trim 安全漏洞
拒绝服务
Components trim是Components团队的一个用于去除字符串两端空格的 Npm 代码库。 Service trim 所有版本存在安全漏洞,该漏洞源于容易受到通过trim()的正则表达式拒绝服务的攻击。
CVE-2020-7753 MPS-2020-14926
2022-08-08 21:03
Auth0 跨站脚本漏洞
XSS
Auth0是是一个身份验证代理,支持社会和企业身份提供者,包括Active Directory、LDAP、谷歌Apps和Salesforce。 auth0-lock在11.30.0版本存在跨站脚本漏洞,该漏洞源于攻击者可利用该漏洞可以执行任意代码库跨站脚本攻击。
CVE-2021-32641 MPS-2021-7409
2022-08-08 21:03
Nodemailer 注入漏洞
注入
Nodemailer是Nodemailer团队的一个使用可提供发送邮件功能的 JS 代码库。 Nodemailer 中存在注入漏洞,该漏洞源于系统未对HTTP Header做安全检查。攻击者可通过包含换行符或回车符的恶意数据引发目标系统产品异常行为。以下产品及版本受到影响:nodemailer 6.6.1 之前版本。
CVE-2021-23400 MPS-2021-9219
2022-08-08 21:03
Digital Bazaar Forge 数据伪造问题漏洞
密码学签名的验证不恰当
Digital Bazaar Forge是美国Digital Bazaar公司的一个 Tls 在 Javascript 中的本机实现以及用于编写基于加密和网络密集型 Web 应用程序的开源工具。 Forge 1.3.0 版本之前 RSA PKCS 存在数据伪造问题漏洞,该漏洞源于 RSA PKCS 签名验证码对摘要算法结构的检查较为宽松。攻击者可以通过精心设计的结构窃取填充字节并在使用低公共指数时使用 PKCS#1 编码消息的未检查部分来伪造签名。
CVE-2022-24771 MPS-2022-3738
2022-08-08 21:03
Sharp 安全漏洞
命令注入
sharp是lovell个人开发者的一款用于将常见格式的大图像转换为更小的、对 Web 友好的 JPEG、PNG、WebP、GIF 和不同尺寸的 AVIF 图像。 sharp 0.30.5 之前版本存在安全漏洞。攻击者利用该漏洞能够在构建环境中设置环境变量的值注入任意命令。
CVE-2022-29256 MPS-2022-8657
2022-08-08 21:03
nanoid安全漏洞
不正确的类型转换
nanoid是用于 JavaScript 的小型、安全、URL 友好、唯一的字符串 ID 生成器。 nanoid安全中存在漏洞,该漏洞源于nanoid 容易通过 valueOf() 函数受到信息暴露的影响,该函数允许重现最后生成的 id。
CVE-2021-23566 MPS-2021-19605
2022-08-08 21:03
Async 安全漏洞
原型污染
Async是英国Caolan McMahon个人开发者的一个实用模块。用于使用异步 JavaScript。 Async 3.2.1 及之前版本存在安全漏洞,该漏洞源于 mapValues() 方法。攻击者可通过 mapValues() 方法获取权限。
CVE-2021-43138 MPS-2021-34434
2022-08-08 21:03
nodejs 资源管理错误漏洞
拒绝服务
nodejs是是一个基于ChromeV8引擎的JavaScript运行环境通过对Chromev8引擎进行了封装以及使用事件驱动和非阻塞IO的应用让Javascript开发高性能的后台应用成为了可能。 nodejs-glob-parent 存在安全漏洞,该漏洞源于正则表达式拒绝服务。
CVE-2020-28469 MPS-2021-7827
2022-08-08 21:03
undici < 5.7.1 存在CRLF序列注入漏洞
CRLF注入
undici是一个HTTP/1.1客户端。在小于5.7.1的undici版本中,可以将 CRLF序列注入到 undici 中的请求标头中,从而引起http请求拆分漏洞。
CVE-2022-31150 MPS-2022-11180
2022-08-08 21:03
@apollo/client 存在信息暴露漏洞
信息暴露
@apollo/client 是一个功能齐全的缓存 GraphQL 客户端。此软件包的受影响版本容易受到信息泄露的影响。
MPS-2022-13548
2022-08-08 21:03
node-forge 存在原型污染漏洞
原型污染
node-forge 是网络传输、密码学、密码、PKI、消息摘要和各种实用程序的 JavaScript 实现。此软件包的受影响版本容易受到通过伪造的原型污染。
MPS-2022-13920
2022-08-08 21:03
follow-redirects project信息暴露漏洞
信息暴露
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
CVE-2022-0536 MPS-2022-3636
2022-08-08 21:03
没有更多内容
加载失败,请刷新页面
点击加载更多
加载中
下一页
0 评论
0 收藏
分享
OSCHINA
登录后可查看更多优质内容
返回顶部
顶部